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Remarks 

Claims 1, 4-7, 9-10, 13-16, 19-20, 24-26, 39-43, 46, 48-50, and 52-53 are 
pending. 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the 
fee set forth in 37 CFR 1 .17(e), was filed in this application after final rejection. 
Since this application is eligible for continued examination under 37 CFR 1.114, 
and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the 
previous Office action has been withdrawn pursuant to 37 CFR 1 .1 14. 
Applicant's submission filed on 9/23/2010 has been entered. 

Response to Arguments 

2. Applicant's arguments with respect to claims 1 , 4-7, 9-1 0, 1 3-1 6, 1 9-20, 
24-26, 39-43, 46, 48-50, and 52-53 have been considered but are moot in view of 
the new ground(s) of rejection. 

Claim Objections 

3. Claim 48 is objected to because of the following informalities: Claim 48 
states that it is dependent from claim 8, however, claim 8 has been canceled. 
For purposes of prior art rejection, claim 48 has been construed as being 
dependent from claim 1 . Appropriate correction is required. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

4. Claims 1 , 4-6, 39-42, and 46 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Stewart (U.S. Patent 6,732,176) in view of Genty (U.S. Patent 
7,496,755) and Short (U.S. Patent 7,194,554). 
Regarding Claim 1, 

Stewart discloses a method of controlling access to a 
network, the method comprising: 

Configuring an authentication server to include a first 
location information corresponding to an identity of a mobile client, 
the first location information being a location at which the mobile 
client is permitted to connect to the network (Column 1 1 , lines 28- 
53; and Column 16, lines 38-64; storing information regarding 
special locations, for example. In addition, U.S. Patent 5,835,061, 
incorporated by reference in column 4, lines 39-43, includes 
additional information regarding storing of locations); 

Requesting by a network switch the identity of the mobile 
client from the mobile client attempting to connect to the network 
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(Column 10, line 64 to Column 11, line 16; request for identification 
information, for example); 

Receiving, by the authentication server, the identity of the 
mobile client via the network switch (Column 11, lines 17-53); 

Associating, by the network switch, a second location 
information corresponding to the mobile client with the identity of 
the mobile client, wherein the second location information indicates 
a location of the network switch coupled to the network to which the 
mobile client is attempting to connect (Column 8, lines 17-33; 
Column 11, lines 17-53; and Column 16, lines 38-64; associating 
the client's current location with the client, where the client's 
location can be that of the AP to which the client is connecting, for 
example); 

Authenticating, by the authentication server, the identity of 
the mobile client received by the authentication server (Column 9, 
lines 28-47; Column 12, line 30 to Column 13, line 10; and Column 
18, lines 1-25); 

Comparing, by the authentication server, the second location 
information corresponding to the mobile client against the first 
location information (Column 11, lines 28-53; and Column 16, lines 
38-64; determining access levels based on current location 
compared to stored locations, for example); 
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Deciding, by the authentication server, whether to grant or 
deny access to the network for the mobile client in response to 
authenticating the identity of the mobile client and in response to 
comparing the second location information against the first location 
information (Column 11, lines 28-53; Column 12, lines 47-63; and 
Column 16, lines 15-55; granting differing levels of access based 
on identification information as well as geographic information, for 
example); and 

Informing the network switch by the authentication server 
whether to grant or deny access to the network for the mobile client 
(Figure 4; 224, 226, 232; Column 1 1 , lines 28-53; Column 1 2, lines 
47-63; and Column 16, lines 15-55; allowing or disallowing access 
based on identification, geographic information, and the like, for 
example); 

But does not explicitly disclose that the authentication server 
is coupled to the network and comprises a Remote Authentication 
Dial-In User Service (RADIUS) server having RADIUS attributes; or 
that the first location information is included within a RADIUS 
vendor specific attribute (VSA) of the RADIUS attributes. 

Genty, however, discloses that the authentication server is 
coupled to the network and comprises a Remote Authentication 
Dial-In User Service (RADIUS) server having RADIUS attributes 
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(Abstract; Column 12, lines 30-44; and Column 14, lines 27-45; 
RADIUS server with RADIUS attributes, for example); and 

That RADIUS can be extended to attributes not defined in 
RADIUS by a vendor by use of vendor specific attributes (VSAs) 
(Column 12, lines 30-44). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to 
incorporate the authentication techniques of Genty into the 
distributed network access system of Stewart in order to allow the 
system to easily specify any information required within the 
authentication server or corresponding database by use of an 
extensible attribute set, thereby allowing additional types of 
information to be stored for authentication purposes even after the 
system has been deployed. 

Short, however, discloses that the extended attribute (stored 
in the VSA in the combination) is the first location information and 
that the first location information used in comparison is taken from 
the extended attribute (Column 7, line 41 to Column 8, line 32; and 
Column 10, lines 9-63; storing locations in the profile, which can 
store RADIUS information, for example). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's 
invention to incorporate the profile-based authorization system of 
Short into the distributed network access system of Stewart as 
modified by Genty in order to allow the system to verify a variety of 
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information such as location, device, user, time, location status, etc. 
with respect to the client's profile prior to authorizing access, 
thereby providing fine-grained access control. 

Regarding Claim 39, 

Claim 39 is a system claim that corresponds to method claim 
1 and is rejected for the same reasons. 

Regarding Claim 4, 

Stewart as modified by Genty and Short discloses the 
method of claim 1 , in addition, Stewart discloses that the identity of 
the mobile client includes information selected from the group 
consisting of a user name, a user password, a certificate, a MAC 
address, a shared encryption key, a smart card identifier, and any 
combination of the foregoing information (Column 10, lines 53-63). 

Regarding Claim 40, 

Claim 40 is a system claim that corresponds to method claim 
4 and is rejected for the same reasons. 

Regarding Claim 5, 

Stewart as modified by Genty and Short discloses the 
method of claim 1 , in addition, Stewart discloses that the mobile 
client is a user station capable of connecting to the network through 
an access point (Column 1 0, line 64 to Column 1 1 , line 1 6). 

Regarding Claim 41, 
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Claim 41 is a system claim that corresponds to method claim 

5 and is rejected for the same reasons. 
Regarding Claim 6, 

Stewart as modified by Genty and Short discloses the 
method of claim 1 , in addition, Stewart discloses that the mobile 
client is a wired device capable of connecting to the network 
through an Ethernet switch port (Column 5, lines 2-24; Column 6, 
lines 40-59; and Column 9, lines 48-64). 
Regarding Claim 42, 

Claim 42 is a system claim that corresponds to method claim 

6 and is rejected for the same reasons. 
Regarding Claim 46, 

Stewart as modified by Genty and Short discloses the 
method of claim 1 , in addition, Stewart discloses that the mobile 
client is associated with a newly located access point upon 
authenticating the identity of the mobile client and determining, by 
comparing an updated location information corresponding to the 
mobile client against the first location information in the policy table, 
the first location information being the information that the mobile 
client is still authorized to access the network (Column 9, lines 28- 
47; Column 10, lines 25-37; Column 12, line 30 to Column 13, line 
10; Column 14, line 57 to Column 15, line 15; and Column 18, lines 
1-25). 
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5. Claims 7 and 43 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Stewart in view of Genty and Short, further in view of Funk 
(Funk Software, "Comprehensive RADIUS/AAA Solution for the Global 
Enterprise", 2/22/2003, pp. 1-6). 
Regarding Claim 7, 

Stewart as modified by Genty and Short does not explicitly 
disclose that authenticating the identity of the mobile client 
comprises authenticating the identity of the mobile client via a 
mechanism selected from the group comprising TLS, TTLS, MD5, 
EAP-TLS, and any combination of the foregoing. 

Funk, however, discloses that authenticating the identity of 
the mobile client comprises authenticating the identity of the mobile 
client via a mechanism selected from the group comprising TLS, 
TTLS, MD5, EAP-TLS, and any combination of the foregoing (Page 
3). It would have been obvious to one of ordinary skill in the art at 
the time of applicant's invention to incorporate the AAA system of 
Funk into the distributed network access system of Stewart as 
modified by Genty and Short in order to allow the system to 
authenticate via a wide array of authentication mechanisms, and/or 
to provide high reliability and uptime. 
Regarding Claim 43, 



Application/Control Number: 10/774,079 Pa 
Art Unit: 2491 

Claim 43 is a system claim that is broader than method claim 
7 and is rejected for the same reasons. 



6. Claim 48 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Stewart in view of Genty and Short, further in view of Liming (U.S. Patent 
Application Publication 2002/0055924). 

Stewart as modified by Genty and Short does not explicitly disclose 
that the second location information indicates a location of a port of the 
network switch to which the mobile client is attempting to connect. 

Liming, however, discloses that the second location information 
indicates a location of a port of the network switch to which the mobile 
client is attempting to connect (Paragraphs 159, 165, and 181). It would 
have been obvious to one of ordinary skill in the art at the time of 
applicant's invention to incorporate the location context system of Liming 
into the distributed network access system of Stewart as modified by 
Genty and Short in order to allow the system to associate location 
information with the client even when the other devices cannot provide 
such location information, thereby extending the system to be able to be 
used when the client connects directly to a switch and/or when the other 
devices between the client and switch do not have any means to 
associate location information with the client. 



Application/Control Number: 10/774,079 Page 1 1 

Art Unit: 2491 

7. Claims 9, 10, 13-16, 19, 24, and 52-53 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Stewart in view of Genty, Short, and Torvinen 
(U.S. Patent Application Publication 2005/0149443). 
Regarding Claim 9, 

Stewart as modified by Genty and Short discloses the 
method of claim 1, in addition, Stewart discloses storing the second 
location information on the network switch (Column 7, line 62 to 
Column 8, line 3; Column 11, lines 28-53; and Column 16, lines 38- 
64); 

But does not explicitly disclose periodically downloading the 
stored second location information to an edge device, wherein the 
mobile client is operable to connect to the network via the edge 
device. 

Torvinen, however, discloses periodically downloading the 
stored second location information to an edge device, wherein the 
mobile client is operable to connect to the network via the edge 
device (Paragraphs 27-28, 30, 42, 45, 54, and 58; updating of the 
location for the group, and downloading such location to clients 
when they attempt to access the group, as an example). It would 
have been obvious to one of ordinary skill in the art at the time of 
applicant's invention to incorporate the conditional group access 
system of Torvinen into the distributed network access system of 
Stewart as modified by Genty and Short in order to allow various 
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groups to be formed, by network operators and normal users alike, 
such that groups may be based upon the location of the device, 
device capabilities, user capabilities or subscriptions, etc., thereby 
providing additional beneficial services to users by allowing them to 
communicate with other users that are in the same location and/or 
have the same interests. 
Regarding Claim 53, 

Claim 53 is a system claim that corresponds to method claim 
9 and is rejected for the same reasons. 
Regarding Claim 10, 

Stewart discloses a network system comprising: 

A network (Figure 1); 

An authentication server coupled to the network, the 
authentication server configured to include a first location 
information corresponding to an identity of a mobile client, the first 
location information being a location at which the mobile client is 
permitted to connect to the network (Column 1 1 , lines 28-53; and 
Column 16, lines 38-64); 

A network switch coupled to the network and having an 
authenticator for requesting an identity from the mobile client and 
for associating a second location information corresponding to the 
mobile client with the identity of the mobile client, wherein the 
mobile client is operable to communicate to the authenticator of the 
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network switch, and wherein the second location information 
indicates a location of the network switch coupled to the network to 
which the mobile client is attempting to connect (Column 8, lines 
1 7-33; Column 1 0, line 64 to Column 1 1 , line 53; and Column 1 6, 
lines 38-64); and 

Wherein the authentication server is operable to: 

Authenticate the identity of the mobile client received by the 
authentication server (Column 9, lines 28-47; Column 12, line 30 to 
Column 13, line 10; and Column 18, lines 1-25); 

Compare the second location information corresponding to 
the mobile client against the first location information (Column 1 1 , 
lines 28-53; and Column 16, lines 38-64); 

Decide whether to grant or deny access to the network for 
the mobile client in response to comparing the second location 
information against the first location information (Column 1 1 , lines 
28-53; Column 12, lines 47-63; and Column 16, lines 15-55); and 

Inform the network switch whether to grant or deny access to 
the network for the mobile client (Figure 4; 224, 226, 232; Column 
11, lines 28-53; Column 12, lines 47-63; and Column 16, lines 15- 
55); 

But does not explicitly disclose that the authentication server 
comprises a RADIUS server having RADIUS attributes; that the first 
location information is included within a RADIUS VSA of the 
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RADIUS attributes; or a network manager comprising an 
application running on a server, wherein the application permits a 
network administrator to create and update a policy table of the 
authentication server. 

Genty, however, discloses that the authentication server is 
coupled to the network and comprises a Remote Authentication 
Dial-In User Service (RADIUS) server having RADIUS attributes 
(Abstract; Column 12, lines 30-44; and Column 14, lines 27-45); 
and 

That RADIUS can be extended to attributes not defined in 
RADIUS by a vendor by use of vendor specific attributes (VSAs) 
(Column 12, lines 30-44). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to 
incorporate the authentication techniques of Genty into the 
distributed network access system of Stewart in order to allow the 
system to easily specify any information required within the 
authentication server or corresponding database by use of an 
extensible attribute set, thereby allowing additional types of 
information to be stored for authentication purposes even after the 
system has been deployed. 

Short, however, discloses that the extended attribute (stored 
in the VSA in the combination) is the first location information and 
that the first location information used in comparison is taken from 
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the extended attribute (Column 7, line 41 to Column 8, line 32; and 
Column 1 0, lines 9-63). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to 
incorporate the profile-based authorization system of Short into the 
distributed network access system of Stewart as modified by Genty 
in order to allow the system to verify a variety of information such 
as location, device, user, time, location status, etc. with respect to 
the client's profile prior to authorizing access, thereby providing 
fine-grained access control. 

Torvinen, however, discloses a network manager comprising 
an application running on a server, wherein the application permits 
a network administrator to create and update a policy table of the 
authentication server (Paragraphs 27-28, 30, 42, 45, 54, and 58; a 
management component, logic, or application that allows a network 
operator or user in control of a group to create and maintain a data 
structure including a region of interest and/or proficiency level that 
is allowed to join the group in order to perform particular actions or 
acquire particular data associated with the group, for example). It 
would have been obvious to one of ordinary skill in the art at the 
time of applicant's invention to incorporate the conditional group 
access system of Torvinen into the distributed network access 
system of Stewart as modified by Genty and Short in order to allow 
various groups to be formed, by network operators and normal 
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users alike, such that groups may be based upon the location of the 
device, device capabilities, user capabilities or subscriptions, etc., 
thereby providing additional beneficial services to users by allowing 
them to communicate with other users that are in the same location 
and/or have the same interests. 

Regarding Claim 13, 

Stewart as modified by Genty and Short discloses the 
system of claim 10, in addition, Stewart discloses an edge device 
for connecting a user station to the network switch (Figures 2-3). 

Regarding Claim 14, 

Stewart as modified by Genty and Short discloses the 
system of claim 13, in addition, Stewart discloses that the edge 
device is a wireless access point (Column 10, line 64 to Column 11, 
line 16). 

Regarding Claim 15, 

Stewart as modified by Genty and Short discloses the 
system of claim 14, in addition, Stewart discloses that the user 
station is capable of connecting to the network through the wireless 
access point (Column 5, lines 1-14; and Column 10, line 64 to 
Column 11, line 16). 

Regarding Claim 16, 

Stewart as modified by Genty and Short discloses the 
system of claim 10, in addition, Stewart discloses that the mobile 
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client is a wired device capable of connecting to the network switch 
through an Ethernet port (Column 5, lines 2-24; Column 6, lines 40- 
59; and Column 9, lines 48-64). 

Regarding Claim 19, 

Stewart as modified by Genty and Short discloses the 
system of claim 10, in addition, Torvinen discloses an interface for 
permitting an administrator to associate the second location 
information to the mobile client (Paragraphs 27-28, 30, 40, 42, 45, 
54, and 58; associating the location-based group with mobile 
clients, for example). 

Regarding Claim 24, 

Stewart as modified by Genty and Short discloses the 
system of claim 10, in addition, Stewart discloses that the identity of 
the mobile client includes information selected from the group 
consisting of a user name, a user password, a certificate, a MAC 
address, a shared key, a smart card identifier, and any combination 
of the foregoing information (Column 10, lines 53-63). 

Regarding Claim 52, 

Stewart as modified by Genty, Short, and Torvinen discloses 
the system of claim 10, in addition, Stewart discloses means for 
storing the second location information on the network switch 
(Column 7, line 62 to Column 8, line 3; Column 1 1 , lines 28-53; and 
Column 16, lines 38-64); and 
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Torvinen discloses means for periodically downloading the 
stored second location information to an edge device, wherein the 
mobile client is operable to connect to the network via the edge 
device (Paragraphs 27-28, 30, 42, 45, 54, and 58). 

8. Claim 20 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Stewart in view of Genty, Short, and Torvinen, further in view of Kwan (U.S. 
Patent Application Publication 2004/0255154). 

Stewart as modified by Genty, Short, and Torvinen does not 

explicitly disclose that the authentication server is included in a network 

switch. 

Kwan, however, discloses that the authentication server is included 
in a network switch (Paragraph 36). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to incorporate 
the multi-tiered network security system of Kwan into the distributed 
network access system of Stewart as modified by Genty, Short, and 
Torvinen in order to ensure that a client and its associated user are 
authentic and authorized to use the system by three levels of security 
checks, including physical address authentication of the device, user 
credential authentication, and VLAN group association checks, thereby 
increasing security of the system. 
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9. Claims 25 and 26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Stewart in view of Genty, Short, and Torvinen, further in view 
of Funk. 

Regarding Claim 25, 

Stewart as modified by Genty, Short, and Torvinen does not 
explicitly disclose that the network switch comprises an 
authentication mechanism selected from the group consisting of 
TLS, TTLS, MD5, EAP-TTLS, EAP-TLS, and any combination of 
the foregoing. 

Funk, however, discloses that the network switch comprises 
an authentication mechanism selected from the group consisting of 
TLS, TTLS, MD5, EAP-TTLS, EAP-TLS, and any combination of 
the foregoing (Page 3). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to 
incorporate the AAA system of Funk into the distributed network 
access system of Stewart as modified by Genty, Short, and 
Torvinen in order to allow the system to authenticate via a wide 
array of authentication mechanisms, and/or to provide high 
reliability and uptime. 
Regarding Claim 26, 

Stewart as modified by Genty, Short, and Torvinen does not 
explicitly disclose that the authentication server comprises an 
authentication mechanism selected from the group consisting of 
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TLS, TTLS, MD5, EAP-TTLS, EAP-TLS, and any combination of 
the foregoing. 

Funk, however, discloses that the authentication server 
comprises an authentication mechanism selected from the group 
consisting of TLS, TTLS, MD5, EAP-TTLS, EAP-TLS, and any 
combination of the foregoing (Page 3). It would have been obvious 
to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the AAA system of Funk into the distributed network 
access system of Stewart as modified by Genty, Short, and 
Torvinen in order to allow the system to authenticate via a wide 
array of authentication mechanisms, and/or to provide high 
reliability and uptime. 

10. Claim 49 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Stewart in view of Genty, Short, and Torvinen, further in view of Liming. 

Stewart as modified by Genty, Short, and Torvinen does not 
explicitly disclose that the second location information indicates a location 
of a port of the network switch to which the mobile client is attempting to 
connect. 

Liming, however, discloses that the second location information 
indicates a location of a port of the network switch to which the mobile 
client is attempting to connect (Paragraphs 159, 165, and 181). It would 
have been obvious to one of ordinary skill in the art at the time of 
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applicant's invention to incorporate the location context system of Liming 
into the distributed network access system of Stewart as modified by 
Genty, Short, and Torvinen in order to allow the system to associate 
location information with the client even when the other devices cannot 
provide such location information, thereby extending the system to be able 
to be used when the client connects directly to a switch and/or when the 
other devices between the client and switch do not have any means to 
associate location information with the client. 

1 1 . Claim 50 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Stewart in view of Genty, Short, and Torvinen, further in view of Tan (U.S. Patent 
Application Publication 2001/0045451). 

Stewart as modified by Genty, Short, and Torvinen does not 

explicitly disclose that the identity of the mobile client includes a smart 

card identifier. 

Tan, however, discloses that the identity of the mobile client 
includes a smart card identifier (Paragraphs 20-23). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the smart card-based authentication techniques of Tan into 
the distributed network access system of Stewart as modified by Genty, 
Short, and Torvinen in order to provide multiple factor authentication, such 
that the user must first authenticate to the smart card, which will then allow 
the smart card to authenticate with the authentication server in a much 
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more secure manner than simply by sending a username and/or password 
to the server for authentication. 

Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to JEFFREY D. POPHAM whose telephone 
number is (571)272-7215. The examiner can normally be reached on M-F 9:00- 
5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Ashok Patel can be reached on (571)272-3972. The fax 
phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 



Application/Control Number: 10/774,079 
Art Unit: 2491 



Page 23 



/Jeffrey D Popham/ 
Examiner, Art Unit 2491 



Jeffrey D Popham 

Examiner 

Art Unit 2491 



